WINDOWS CENTER: SecurityFocus Newsletter #394

SecurityFocus Newsletter #394
----------------------------------------

This Issue is Sponsored by: SPI Dynamics

ALERT: "How a Hacker Launches a SQL Injection Attack!"- SPI Dynamics White Paper
It's as simple as placing additional SQL commands into a Web Form input box giving hackers complete access to all your backend systems! Firewalls and IDS will not stop such attacks because SQL Injections are NOT seen as intruders. Download this *FREE* white paper from SPI Dynamics for a complete guide to protection!

https://download.spidynamics.com/1/ad/sql.asp?Campaign_ID=70160000000CkvN

------------------------------------------------------------------
I. FRONT AND CENTER
1. Metasploit 3.0 day
2. Blanket Discovery for Stolen Laptops
II. BUGTRAQ SUMMARY
1. Squid Proxy TRACE Request Remote Denial of Service Vulnerability
2. Inkscape Malicious URI Format String Vulnerability
3. SB-WebSoft Addressbook Local File Include Vulnerability
4. Asterisk PBX_AEL.C Switch Blocks Security Bypass Vulnerability
5. FTP Explorer PWD Parameter Denial Of Service Vulnerability
6. C-Arbre Multiple Remote File Include Vulnerabilities
7. IceBB Avatar Upload Remote PHP Code Execution Vulnerability
8. SignKorea SKCommAX ActiveX Control Remote Buffer Overflow Vulnerability
9. LibFTP Multiple Remote Buffer Overflow Vulnerabilities
10. PHP Version 5.2.0 and Prior Multiple Vulnerabilities
11. High Performance Anonymous FTP Server Multiple Remote Buffer Overflow Vulnerabilities
12. PHP Mail Function ASCIIZ Message Truncation Weakness
13. PHP Folded Mail Headers Email Header Injection Vulnerability
14. Xen QEMU VNC Server Arbitrary Information Disclosure Vulnerability
15. MySQL Single Row SubSelect Remote Denial Of Service Vulnerability
16. Fizzle RSS Feed HTML Injection Vulnerability
17. Satel Lite Satellite.PHP Local File Include Vulnerability
18. Linux Kernel IPV6_SockGlue.c NULL Pointer Dereference Vulnerability
19. Mephisto Blog Search Function Cross-Site Scripting Vulnerability
20. GNU GV Stack Buffer Overflow Vulnerability
21. File(1) Command File_PrintF Integer Underflow Vulnerability
22. TCPDump IEEE802.11 printer Remote Buffer Overflow Vulnerability
23. Linux Kernel IPv6 TCP Sockets Local Denial of Service Vulnerability
24. Apple Mac OS X Multiple Applications Multiple Vulnerabilities
25. TTCMS EZ_SQL.PHP Remote File Include Vulnerability
26. CUPS Partial SSL Connection Remote Denial of Service Vulnerability
27. Linux Kernel DCCP Multiple Local Information Disclosure Vulnerabilities
28. Overlay Weaver Unspecified Cross-Site Scripting Vulnerability
29. NetBSD ISO(4) Buffer Overflow Vulnerability
30. ManageEngine Firewall Analyzer Arbitrary Files Information Disclosure Vulnerability
31. IBM Rational ClearQuest Defect Logging Attachment Cross-Site Scripting Vulnerability
32. Microsoft Windows Cursor And Icon ANI Format Handling Remote Code Execution Vulnerability
33. Mod_Perl Path_Info Remote Denial Of Service Vulnerability
34. Xoops Friendfinder Module View.PHP SQL Injection Vulnerability
35. iPhotoAlbum Multiple File Include Vulnerabilities
36. Retired: iPhotoAlbum Header.PHP Remote File Include Vulnerability
37. LDAP Account Manager Unspecified HTML Injection Vulnerability
38. MangoBery Multiple Remote File Include Vulnerabilities
39. KDE Konqueror/IOSlave FTP PASV Port-Scanning Vulnerability
40. KDE Konqueror JavaScript IFrame Denial of Service Vulnerability
41. Inkscape Client Malicious Jabber Server Format String Vulnerability
42. Microsoft Internet Explorer FTP URI Arbitrary FTP Server Command Execution Vulnerability
43. Microsoft Internet Explorer OuterHTML Redirection Handling Information Disclosure Vulnerability
44. Microsoft Internet Explorer Frameset Memory Corruption Vulnerability
45. Microsoft Internet Explorer Deleted Frame Object Denial Of Service Vulnerability
46. Microsoft Internet Explorer HTML Layout and Positioning Remote Code Execution Vulnerability
47. Microsoft Internet Explorer Chained Cascading Style Sheets Remote Code Execution Vulnerability
48. Microsoft Internet Explorer Window Location Cross-Domain Information Disclosure Vulnerability
49. Microsoft Internet Explorer COM Object Instantiation Code Execution Vulnerability
50. Microsoft Internet Explorer Source Element Cross-Domain Information Disclosure Vulnerability
51. Microsoft Internet Explorer HTTP 1.1 and Compression Long URI Buffer Overflow Vulnerability
52. Microsoft Internet Explorer HTTP 1.1 and Compression Long URI Buffer Overflow Variant Vulnerability
53. PHP Session.Save_Path() TMPDIR Open_Basedir Restriction Bypass Vulnerability
54. Data Domain Administration Interface Local Privilege Escalation Vulnerability
55. MsxStudios Advanced Login ProfileEdit.PHP Remote File Include Vulnerability
56. FastStone Image Viewer Unspecified Buffer Overflow Vulnerability
57. ViewCVS Source View Input Validation Vulnerability
58. IBM Lotus Domino LDAP Server Task Heap-Based Buffer Overflow Vulnerability
59. IBM Lotus Domino IMAP Cram-MD5 Buffer Overflow Vulnerability
60. Cisco Unified CallManager And Unified Server Multiple Remote Denial Of Service Vulnerabilities
61. TrueCrypt Mount Set-EUID Local Privilege Escalation Vulnerability
62. OpenOffice Meta Character Remote Shell Command Execution Vulnerability
63. LibWPD Library Multiple Buffer Overflow Vulnerabilities
64. OSTicket Multiple Input Validation Vulnerabilities
65. Mozilla Firefox Javascript URI Remote Code Execution Vulnerability
66. Mozilla Firefox OnUnload Memory Corruption Vulnerability
67. NaviCopa Web Server GET Request Buffer Overflow Vulnerability
68. OpenOffice StarCalc Parser Unspecified Buffer Overflow Vulnerability
69. Microsoft Internet Explorer HTML Denial of Service Vulnerability
70. Mozilla Firefox Popup Blocker Cross Zone Security Bypass Weakness
71. Mozilla Firefox Location.Hostname Dom Property Cookie Theft Vulnerability
72. Mozilla Thunderbird/SeaMonkey/Firefox Multiple Remote Vulnerabilities
73. IBM Lotus Domino Web Access Email Message HTML Injection Vulnerability
74. Xoops Articles Module Print.PHP SQL Injection Vulnerability
75. Corel WordPerfect Office PRS Stack Buffer Overflow Vulnerability
76. NaviCOPA Web Server Remote Buffer Overflow Vulnerability
77. Eve-Nuke Forums MySQL.PHP Remote File Include Vulnerability
78. ESRI ArcSDE Server Unspecified Denial Of Service Vulnerability
79. AY System Solutions Web Content System Remote File Include Vulnerability
80. ISC BIND Remote DNSSEC Validation Denial of Service Vulnerability
81. XMMS Skins Integer Overflow And Underflow Vulnerabilities
82. Network Audio System Local Privilege Escalation and Denial of Service Vulnerabilities
83. PHP Zip_Entry_Read() Integer Overflow Vulnerability
84. JBrowser Upload.PHP3 Arbitrary File Upload Vulnerability
85. Mozilla Firefox 2 Password Manager Cross-Site Information Disclosure Weakness
86. CodeBB PHPBB_Root_Path Remote File Include Vulnerability
87. HP Jetdirect FTP Print Server RERT Command Denial Of Service Vulnerability
88. Free File Hosting Forgot_Pass.PHP Remote File Include Vulnerability
89. Free File Hosting System Multiple Remote File Include Vulnerabilities
90. ABitWhizzy Multiple Cross Site Scripting And Directory Traversal Vulnerabilities
91. Oracle July 2006 Security Update Multiple Vulnerabilities
92. Joomla! D4JeZine Component Index.PHP SQL Injection Vulnerability
93. HP OpenView Network Node Manager Unspecified Remote Unauthorized Access Vulnerability
94. FlexBB Start.PHP SQL Injection Vulnerability
95. Mozilla FireFox FTP PASV Port-Scanning Vulnerability
96. Gnome Evolution Format String Vulnerability
97. Horde Groupware Webmail Edition Unspecified Parameters Multiple HTML Injection Vulnerabilities
98. Mozilla Firefox/SeaMonkey/Thunderbird Multiple Remote Vulnerabilities
99. Microsoft Windows Vista Windows Mail Local File Execution Vulnerability
100. IceBB Avatar Upload Index.PHP SQL Injection Vulnerability
III. SECURITYFOCUS NEWS
1. Groups team to test secure-coding skill
2. Oracle sues rival for hacking, data theft
3. Account pretexters plague Xbox Live
4. Anti-spyware bill could mean tougher fines
IV. SECURITY JOBS LIST SUMMARY
1. [SJ-JOB] Security Consultant, Hertfordshire
2. [SJ-JOB] Sales Engineer, Reston
3. [SJ-JOB] Application Security Architect, Baltimore
4. [SJ-JOB] Sr. Product Manager, Mountain View
5. [SJ-JOB] Customer Service, Mountain View
6. [SJ-JOB] Software Engineer, Mountain View
7. [SJ-JOB] Security System Administrator, Capitol area
8. [SJ-JOB] Security Consultant, New York
9. [SJ-JOB] Security Consultant, Bellevue
10. [SJ-JOB] Security Engineer, Waqshington
11. [SJ-JOB] Security Consultant, Leawood
12. [SJ-JOB] Manager, Information Security, mumbai
13. [SJ-JOB] Security Consultant, Houston
14. [SJ-JOB] Security Consultant, Atlanta
15. [SJ-JOB] Sales Engineer, Detroit
16. [SJ-JOB] Sales Engineer, Chicago
17. [SJ-JOB] Security Consultant, San Francisco
18. [SJ-JOB] Sales Engineer, Irvine
19. [SJ-JOB] Channel / Business Development, Seattle
20. [SJ-JOB] Account Manager, Redwood City
21. [SJ-JOB] Channel / Business Development, Portland
22. [SJ-JOB] Sales Engineer, Redwood City
23. [SJ-JOB] Information Assurance Analyst, Mountain View
24. [SJ-JOB] Security Auditor, London
25. [SJ-JOB] Sales Engineer, San Diego
26. [SJ-JOB] Account Manager, Brookfield
27. [SJ-JOB] Quality Assurance, Cambridge
28. [SJ-JOB] Security Consultant, Berkshire
29. [SJ-JOB] Forensics Engineer, San Francisco
30. [SJ-JOB] Security Consultant, Berkshire / Hampshire
31. [SJ-JOB] Technical Support Engineer, West London
32. [SJ-JOB] Security Architect, Surrey / Berkshire
33. [SJ-JOB] Security System Administrator, University Park
34. [SJ-JOB] Sales Engineer, Dallas
35. [SJ-JOB] Sales Engineer, New York City
36. [SJ-JOB] Sales Engineer, Houston
37. [SJ-JOB] Security Consultant, Herndon
38. [SJ-JOB] Application Security Engineer, Arlington
V. INCIDENTS LIST SUMMARY
VI. VULN-DEV RESEARCH LIST SUMMARY
1. Metasploit Framework 3.0 RELEASED!
VII. MICROSOFT FOCUS LIST SUMMARY
1. Multiple Profile ~ XP
2. Administrivia: New List Moderators
3. Administrivia: Farewell
4. Shared drives through a firewall
VIII. SUN FOCUS LIST SUMMARY
IX. LINUX FOCUS LIST SUMMARY
X. UNSUBSCRIBE INSTRUCTIONS
XI. SPONSOR INFORMATION

I. FRONT AND CENTER
---------------------
1. Metasploit 3.0 day
By Federico Biancuzzi
The Metasploit Framework is a development platform for creating security tools and exploits. Federico Biancuzzi interviewed H D Moore to discuss what's new in release 3.0, the new license of the framework, plans for features and exploits development, and the links among the bad guys and Metasploit and the law.
http://www.securityfocus.com/columnists/439

2. Blanket Discovery for Stolen Laptops
By Mark Rasch
Mark Rasch discusses the legal issues behind the discovery and recovery of stolen laptops that use LoJack-style homing devices to announce their location, and the location of the thieves, anywhere in the world.
http://www.securityfocus.com/columnists/438

II. BUGTRAQ SUMMARY
--------------------
1. Squid Proxy TRACE Request Remote Denial of Service Vulnerability
BugTraq ID: 23085
Remote: Yes
Last Updated: 2007-03-29
Relevant URL: http://www.securityfocus.com/bid/23085
Summary:
Squid is prone to a remote denial-of-service vulnerability because the proxy server fails to handle certain TRACE requests.

Successfully exploiting this issue allows remote attackers to crash the affected application, denying futher service to legitimate users.

This issue affects version 2.6.

2. Inkscape Malicious URI Format String Vulnerability
BugTraq ID: 23070
Remote: Yes
Last Updated: 2007-03-29
Relevant URL: http://www.securityfocus.com/bid/23070
Summary:
Inkscape is prone to a format-string vulnerability.

This issue presents itself because the application fails to properly sanitize user-supplied input before passing it as the format specifier to a formatted-printing function.

A successful attack may crash the application or possibly lead to arbitrary code execution. This may facilitate unauthorized access or privilege escalation in the context of the user running the application.

3. SB-WebSoft Addressbook Local File Include Vulnerability
BugTraq ID: 23156
Remote: Yes
Last Updated: 2007-03-27
Relevant URL: http://www.securityfocus.com/bid/23156
Summary:
SB-WebSoft Addressbook is prone to a local file-include vulnerability because it fails to sufficiently sanitize user-supplied data.

Exploiting this issue may allow an attacker to access sensitive information and to execute local script code in the context of the application; this may facilitate other attacks against the affected computer.

4. Asterisk PBX_AEL.C Switch Blocks Security Bypass Vulnerability
BugTraq ID: 23155
Remote: Yes
Last Updated: 2007-03-27
Relevant URL: http://www.securityfocus.com/bid/23155
Summary:
Asterisk PBX is prone to a security-bypass vulnerability because the Asterisk Extension Language (AEL) fails to securely generate extensions when compiling arbitrary labels.

An attacker can exploit this issue to bypass security restrictions. The attacker may then be able to access sensitive information and to change user settings.

This issue affects versions in the 1.2.0 and 1.4.0 branches.

This issue affects all versions in the following branches:

1.2.x
1.4.x

5. FTP Explorer PWD Parameter Denial Of Service Vulnerability
BugTraq ID: 22640
Remote: Yes
Last Updated: 2007-03-27
Relevant URL: http://www.securityfocus.com/bid/22640
Summary:
FTP Explorer is prone to a denial-of-service vulnerability because the application fails to properly handle overly long PWD responses.

Exploiting this issue will cause 100% CPU exhaustion, resulting in a denial-of-service condition. Due to the nature of this vulnerability, attackers may be able to execute arbitrary machine code in the context of the affected application.

This issue affects version 1.0.1 Build 047; other versions may also be affected.

6. C-Arbre Multiple Remote File Include Vulnerabilities
BugTraq ID: 23154
Remote: Yes
Last Updated: 2007-03-27
Relevant URL: http://www.securityfocus.com/bid/23154
Summary:
C-Arbre is prone to multiple remote file-include vulnerabilities because it fails to sufficiently sanitize user-supplied data.

Exploiting these issues may allow an attacker to compromise the application and the underlying system; other attacks are also possible.

C-Arbre 0.6PR7 and prior versions are vulnerable to these issues.

7. IceBB Avatar Upload Remote PHP Code Execution Vulnerability
BugTraq ID: 23151
Remote: Yes
Last Updated: 2007-03-27
Relevant URL: http://www.securityfocus.com/bid/23151
Summary:
IceBB is prone to an arbitrary PHP code-execution vulnerability.

An attacker can exploit this issue to execute arbitrary malicious PHP code by uploading malicious PHP files. This may help the attacker compromise the application and the underlying system; other attacks are also possible.

Version 1.0-rc5 is vulnerable to this issue; other versions may also be affected.

8. SignKorea SKCommAX ActiveX Control Remote Buffer Overflow Vulnerability
BugTraq ID: 23149
Remote: Yes
Last Updated: 2007-03-27
Relevant URL: http://www.securityfocus.com/bid/23149
Summary:
SignKorea SKCommAX ActiveX control is prone to a remote buffer-overflow vulnerability because the software fails to properly bounds-check user-supplied input before copying it to insufficiently sized memory buffers.

Exploiting this issue allows remote attackers to execute arbitrary machine code in the context of applications that employ the vulnerable controls (typically Microsoft Internet Explorer).

SignKorea SKCommAX ActiveX Control 7.2.0.2 and 6.6.0.1 are vulnerable to this issue; other versions may also be vulnerable.

9. LibFTP Multiple Remote Buffer Overflow Vulnerabilities
BugTraq ID: 22987
Remote: Yes
Last Updated: 2007-03-27
Relevant URL: http://www.securityfocus.com/bid/22987
Summary:
The 'libftp' library is prone to multiple remote buffer-overflow vulnerabilities because the software fails to bounds-check user-supplied data before copying it into an insufficiently sized buffer.

An attacker can exploit these issues to execute arbitrary code within the context of applications that rely on the affected library. Failed exploit attempts will result in a denial of service.

Version 5.0 of libftp is vulnerable; other versions may also be affected.

10. PHP Version 5.2.0 and Prior Multiple Vulnerabilities
BugTraq ID: 22496
Remote: Yes
Last Updated: 2007-03-27
Relevant URL: http://www.securityfocus.com/bid/22496
Summary:
PHP version 5.2.0 and prior is prone to multiple security vulnerabilities. Successful exploits could allow an attacker to write files in unauthorized locations, cause a denial-of-service condition, and potentially execute code.

These issues are reported to affect PHP 4.4.4 and prior versions in the 4 branch, and 5.2.0 and prior versions in the 5 branch; other versions may also be vulnerable.

11. High Performance Anonymous FTP Server Multiple Remote Buffer Overflow Vulnerabilities
BugTraq ID: 23147
Remote: Yes
Last Updated: 2007-03-27
Relevant URL: http://www.securityfocus.com/bid/23147
Summary:
High Performance Anonymous FTP server is prone to multiple remote buffer-overflow vulnerabilities because the application fails to bounds-check user-supplied data before copying it into an insufficiently sized buffer.

An attacker can exploit these issues to execute arbitrary code within the context of the affected application. Failed exploit attempts will result in a denial of service.

High Performance Anonymous FTP server version 1.01 is vulnerable; other versions may also be affected.

12. PHP Mail Function ASCIIZ Message Truncation Weakness
BugTraq ID: 23146
Remote: Yes
Last Updated: 2007-03-27
Relevant URL: http://www.securityfocus.com/bid/23146
Summary:
PHP is prone to a weakness that allows attackers to truncate email text.

Successful exploits may allow attackers to truncate email text to manipulate message content. This may potentially assist in phishing or other attacks.

This issue affects PHP versions 4 to 4.4.6 and 5 to 5.2.1.

13. PHP Folded Mail Headers Email Header Injection Vulnerability
BugTraq ID: 23145
Remote: Yes
Last Updated: 2007-03-27
Relevant URL: http://www.securityfocus.com/bid/23145
Summary:
PHP is prone to an email-header-injection vulnerability because it fails to properly sanitize user-supplied input when constructing email messages.

Exploiting this issue allows a malicious user to create arbitrary email headers, and then create and transmit spam messages from the affected computer.

The following versions are vulnerable:

PHP 4 up to and including 4.4.6
PHP 5 up to and including 5.2.1

14. Xen QEMU VNC Server Arbitrary Information Disclosure Vulnerability
BugTraq ID: 22967
Remote: Yes
Last Updated: 2007-03-27
Relevant URL: http://www.securityfocus.com/bid/22967
Summary:
Xen is prone to an unspecified vulnerability that lets attackers obtain arbitrary information. The issue stems from a flaw in the VNC server code in QEMU.

An attacker can exploit this issue to access sensitive information that may aid in further attacks.

15. MySQL Single Row SubSelect Remote Denial Of Service Vulnerability
BugTraq ID: 22900
Remote: Yes
Last Updated: 2007-03-26
Relevant URL: http://www.securityfocus.com/bid/22900
Summary:
MySQL is prone to a remote denial-of-service vulnerability because it fails to handle certain select statements to database metadata.

An attacker can exploit this issue to crash the application, denying access to legitimate users. The attacker may also be able to execute arbitrary code, but this has not yet been confirmed.

NOTE: An attacker must be able to execute arbitrary SELECT statements on the vulnerable computer to exploit this issue. This may be through legitimate means or by exploiting other latent SQL-injection vulnerabilities.

Versions prior to 5.0.36 are vulnerable.

16. Fizzle RSS Feed HTML Injection Vulnerability
BugTraq ID: 23144
Remote: Yes
Last Updated: 2007-03-26
Relevant URL: http://www.securityfocus.com/bid/23144
Summary:
Fizzle is prone to an HTML-injection vulnerability because the application fails to properly sanitize user-supplied input before using it in dynamically generated content.

Attacker-supplied HTML and script code would run in the context of the affected browser, potentially allowing an attacker to steal cookie-based authentication credentials or to control how the site is rendered to the user. Other attacks are also possible.

This issue affects version 0.5; other versions may also be affected.

17. Satel Lite Satellite.PHP Local File Include Vulnerability
BugTraq ID: 23143
Remote: Yes
Last Updated: 2007-03-26
Relevant URL: http://www.securityfocus.com/bid/23143
Summary:
Satel Lite is prone to a local file-include vulnerability because it fails to sufficiently sanitize user-supplied data.

18. Linux Kernel IPV6_SockGlue.c NULL Pointer Dereference Vulnerability
BugTraq ID: 23142
Remote: No
Last Updated: 2007-03-26
Relevant URL: http://www.securityfocus.com/bid/23142
Summary:
The Linux kernel is prone to a NULL-pointer dereference vulnerability.

A local attacker can exploit this issue to crash the affected application, denying service to legitimate users. The attacker may also be able to execute arbitrary code with elevated privileges, but this has not been confirmed.

19. Mephisto Blog Search Function Cross-Site Scripting Vulnerability
BugTraq ID: 23141
Remote: Yes
Last Updated: 2007-03-26
Relevant URL: http://www.securityfocus.com/bid/23141
Summary:
Mephisto Blog is prone to a cross-site scripting vulnerability because the application fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

Mephisto Blog version 0.7.3 is vulnerable to this issue; other versions may also be affected.

20. GNU GV Stack Buffer Overflow Vulnerability
BugTraq ID: 20978
Remote: Yes
Last Updated: 2007-03-26
Relevant URL: http://www.securityfocus.com/bid/20978
Summary:
GNU gv is prone to a stack-based buffer-overflow vulnerability because the application fails to properly bounds-check user-supplied data before copying it into an insufficiently sized memory buffer.

Exploiting this issue allows attackers to execute arbitrary machine code in the context of users running the affected application. Failed attempts will likely crash the application, resulting in denial-of-service conditions.

Version 3.6.2 is reported vulnerable; other versions may also be affected.

NOTE: Various other applications may employ embedded GNU gv code and could also be vulnerable as a result.

21. File(1) Command File_PrintF Integer Underflow Vulnerability
BugTraq ID: 23021
Remote: Yes
Last Updated: 2007-03-26
Relevant URL: http://www.securityfocus.com/bid/23021
Summary:
The file(1) command is prone to an integer-underflow vulnerability because the command fails to adequately handle user-supplied data.

An attacker can leverage this issue to corrupt heap memory and execute arbitrary code with the privileges of a user running the command. A successful attack may result in the compromise of affected computers. Failed attempts will likely cause denial-of-service conditions.

Versions prior to 4.20 are vulnerable.

22. TCPDump IEEE802.11 printer Remote Buffer Overflow Vulnerability
BugTraq ID: 22772
Remote: Yes
Last Updated: 2007-03-26
Relevant URL: http://www.securityfocus.com/bid/22772
Summary:
The 'tcpdump' utility is prone to a heap-based buffer-overflow vulnerability because it fails to bounds-check user-supplied input before copying it into an insufficiently sized memory buffer.

An attacker can exploit this issue to execute arbitrary malicious code in the context of the user running the affected application. Failed exploit attempts will likely crash the affected application.

This issue affects tcpdump 3.9.5 and prior versions.

23. Linux Kernel IPv6 TCP Sockets Local Denial of Service Vulnerability
BugTraq ID: 23104
Remote: No
Last Updated: 2007-03-26
Relevant URL: http://www.securityfocus.com/bid/23104
Summary:
The Linux kernel is prone to a denial-of-service vulnerability.

Exploiting this issue allows local attackers to cause the kernel to crash, effectively denying service to legitimate users. Attackers may also be able to execute arbitrary code with elevated privileges, but this has not been confirmed.

This issue affects the Linux kernel 2.6 series.

24. Apple Mac OS X Multiple Applications Multiple Vulnerabilities
BugTraq ID: 22948
Remote: Yes
Last Updated: 2007-03-26
Relevant URL: http://www.securityfocus.com/bid/22948
Summary:
Mac OS X is prone to multiple vulnerabilities including stack-based buffer-overflow issues, denial-of-service vulnerabilities, two memory-corruption issues, an integer-overflow issue, two authentication-bypass issues, an information-disclosure vulnerability, and an insecure command-execution issue.

An attacker can exploit these issues to execute arbitrary code in the context of the user running the application, cause denial-of-service conditions, compromise the application, and access or modify data.

Few details regarding these issues are currently available. Separate BIDs for each issue will be created as new information becomes available.

Mac OS X and Mac OS X Server versions 10.3.9 and 10.4 through 10.4.8 are vulnerable.

25. TTCMS EZ_SQL.PHP Remote File Include Vulnerability
BugTraq ID: 23139
Remote: Yes
Last Updated: 2007-03-26
Relevant URL: http://www.securityfocus.com/bid/23139
Summary:
ttCMS is prone to a remote file-include vulnerability because it fails to sufficiently sanitize user-supplied data.

Exploiting this issue may allow an attacker to compromise the application and the underlying system; other attacks are also possible.

This issue affects version 4; other versions may also be affected.

26. CUPS Partial SSL Connection Remote Denial of Service Vulnerability
BugTraq ID: 23127
Remote: Yes
Last Updated: 2007-03-26
Relevant URL: http://www.securityfocus.com/bid/23127
Summary:
CUPS is prone to a remote denial-of-service vulnerability when handling SSL connection requests.

Successfully exploiting this issue allows remote attackers to cause the affected service to stop accepting further requests, denying further service to legitimate users.

NOTE: This issue was originally reported as a vulnerability affecting Apple Mac OS X in BID 22948 (Apple Mac OS X Multiple Applications Multiple Vulnerabilities). Further information indicates that this vulnerability also affects CUPS running on other platforms, so this issue is being assigned a separate BID.

27. Linux Kernel DCCP Multiple Local Information Disclosure Vulnerabilities
BugTraq ID: 23162
Remote: No
Last Updated: 2007-03-29
Relevant URL: http://www.securityfocus.com/bid/23162
Summary:
The Linux kernel is prone to multiple vulnerabilities in its DCCP support. Exploiting these issues can allow local attackers to access privileged information.

An attacker may be able to obtain sensitive data that can potentially aid in further attacks.

Linux Kernel versions in the 2.6.20 and later branch are vulnerable to these issues.

28. Overlay Weaver Unspecified Cross-Site Scripting Vulnerability
BugTraq ID: 23195
Remote: Yes
Last Updated: 2007-03-29
Relevant URL: http://www.securityfocus.com/bid/23195
Summary:
Overlay Weaver is prone to a cross-site scripting vulnerability because the application fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

This issue affects versions 0.5.9 to 0.5.11.

29. NetBSD ISO(4) Buffer Overflow Vulnerability
BugTraq ID: 23193
Remote: No
Last Updated: 2007-03-29
Relevant URL: http://www.securityfocus.com/bid/23193
Summary:
NetBSD 'ISO' is prone to a local buffer-overflow vulnerability because it fails to properly bounds-check user-supplied input before copying it to an insufficiently sized memory buffer.

A local attacker may be able to exploit this issue to elevate privileges to superuser or cause denial-of-service conditions.

30. ManageEngine Firewall Analyzer Arbitrary Files Information Disclosure Vulnerability
BugTraq ID: 23097
Remote: Yes
Last Updated: 2007-03-29
Relevant URL: http://www.securityfocus.com/bid/23097
Summary:
ManageEngine Firewall Analyzer is prone to a remote information-disclosure vulnerability.

A remote authenticated attacker can leverage this issue to access sensitive data. Information obtained could aid in further attacks.

31. IBM Rational ClearQuest Defect Logging Attachment Cross-Site Scripting Vulnerability
BugTraq ID: 22981
Remote: Yes
Last Updated: 2007-03-29
Relevant URL: http://www.securityfocus.com/bid/22981
Summary:
IBM Rational ClearQuest is prone to a cross-site scripting vulnerability because the software fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

32. Microsoft Windows Cursor And Icon ANI Format Handling Remote Code Execution Vulnerability
BugTraq ID: 23194
Remote: Yes
Last Updated: 2007-03-29
Relevant URL: http://www.securityfocus.com/bid/23194
Summary:
Microsoft Windows is prone to a vulnerability that can allow attackers to execute arbitrary remote code. This issue occurs because of a memory-corruption error caused when handling malformed cursor or icon files.

An attacker can exploit this issue to execute arbitrary code with the privileges of an unsuspecting user. A successful attack can result in the compromise of affected user accounts and computers.

This issue affects Windows XP SP2 and Windows Server 2003 SP1 when running Internet Explorer 6 and 7; other versions may also be affected.

33. Mod_Perl Path_Info Remote Denial Of Service Vulnerability
BugTraq ID: 23192
Remote: Yes
Last Updated: 2007-03-29
Relevant URL: http://www.securityfocus.com/bid/23192
Summary:
The 'mod_perl' module is prone to a remote denial-of-service vulnerability.

Successful exploits may allow remote attackers to cause denial-of-service conditions on the webserver running the mod_perl module.

34. Xoops Friendfinder Module View.PHP SQL Injection Vulnerability
BugTraq ID: 23184
Remote: Yes
Last Updated: 2007-03-29
Relevant URL: http://www.securityfocus.com/bid/23184
Summary:
The Xoops Friendfinder module is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database implementation. This issue may help the attacker gain unauthorized access.

Xoops Friendfinder 3.3 and prior versions are reported vulnerable.

35. iPhotoAlbum Multiple File Include Vulnerabilities
BugTraq ID: 14229
Remote: Yes
Last Updated: 2007-03-29
Relevant URL: http://www.securityfocus.com/bid/14229
Summary:
iPhotoAlbum is prone to multiple local and remote file-include vulnerabilities.

An attacker may leverage these issues to execute arbitrary server-side script code that resides on an affected computer with the privileges of the webserver process. This may potentially facilitate unauthorized access.

36. Retired: iPhotoAlbum Header.PHP Remote File Include Vulnerability
BugTraq ID: 23189
Remote: Yes
Last Updated: 2007-03-29
Relevant URL: http://www.securityfocus.com/bid/23189
Summary:
iPhotoAlbum is prone to a remote file-include vulnerability because it fails to sufficiently sanitize user-supplied data.

Exploiting this issue may allow an attacker to compromise the application and the underlying system; other attacks are also possible.

This issue affects version 1.1; other versions may also be affected.

This BID is being retired because this issue was addressed in BID 14229 (iPhotoAlbum Multiple File Include Vulnerabilities)

37. LDAP Account Manager Unspecified HTML Injection Vulnerability
BugTraq ID: 23190
Remote: Yes
Last Updated: 2007-03-29
Relevant URL: http://www.securityfocus.com/bid/23190
Summary:
LDAP Account Manager is prone to an HTML-injection vulnerability because it fails to sufficiently sanitize user-supplied input.

Exploiting this issue may allow an attacker to execute HTML and script code in the context of the affected site, to steal cookie-based authentication credentials, or to control how the site is rendered to the user; other attacks are also possible.

LDAP Account Manager versions prior to 1.3.0 are vulnerable to this issue.

38. MangoBery Multiple Remote File Include Vulnerabilities
BugTraq ID: 23187
Remote: Yes
Last Updated: 2007-03-29
Relevant URL: http://www.securityfocus.com/bid/23187
Summary:
MangoBery is prone to multiple remote file-include vulnerabilities.

An attacker can exploit these issues to include an arbitrary remote file containing malicious PHP code and execute it in the context of the webserver process. This may allow the attacker to compromise the application and the underlying system; other attacks are also possible.

MangoBery 0.5.5 is vulnerable to these issues.

39. KDE Konqueror/IOSlave FTP PASV Port-Scanning Vulnerability
BugTraq ID: 23091
Remote: Yes
Last Updated: 2007-03-29
Relevant URL: http://www.securityfocus.com/bid/23091
Summary:
KDE Konqueror is prone to a vulnerability that may allow attackers to obtain potentially sensitive information.

A successful exploit of this issue would cause the affected application to connect to arbitrary TCP ports and potentially reveal sensitive information about services that are running on the affected computer. Information obtained may aid attackers in further attacks.

40. KDE Konqueror JavaScript IFrame Denial of Service Vulnerability
BugTraq ID: 22814
Remote: Yes
Last Updated: 2007-03-29
Relevant URL: http://www.securityfocus.com/bid/22814
Summary:
KDE Konqueror is prone to a remote denial-of-service vulnerability because of an error in KDE's JavaScript implementation.

An attacker may exploit this vulnerability to cause Konquerer to crash, resulting in denial-of-service conditions.

Konqueror included with KDE version 3.5.5 is vulnerable; other versions may also be affected.

41. Inkscape Client Malicious Jabber Server Format String Vulnerability
BugTraq ID: 23138
Remote: Yes
Last Updated: 2007-03-29
Relevant URL: http://www.securityfocus.com/bid/23138
Summary:
The Inkscape client application is prone to a format-string vulnerability.

This issue presents itself because the application fails to properly sanitize user-supplied input before passing it as the format specifier to a formatted-printing function.

42. Microsoft Internet Explorer FTP URI Arbitrary FTP Server Command Execution Vulnerability
BugTraq ID: 11826
Remote: Yes
Last Updated: 2007-03-29
Relevant URL: http://www.securityfocus.com/bid/11826
Summary:
Microsoft Internet Explorer is reported prone to an arbitrary FTP server command-execution vulnerability. This issue is due to the application's failure to properly sanitize user-supplied URI input before using it to execute FTP commands on remote servers.

This vulnerability allows attackers to embed arbitrary FTP server commands in malicious URIs. Upon following this malicious URI, the victim user's browser will reportedly connect to the attacker-specified FTP server, and the malicious commands will be sent to the server. This may allow malicious files to be downloaded to the victim's computer without their knowledge. Other attacks are also likely possible.

Note: Reportedly, this issue can be leveraged to send email to arbitrary addresses without user interaction.

43. Microsoft Internet Explorer OuterHTML Redirection Handling Information Disclosure Vulnerability
BugTraq ID: 18682
Remote: Yes
Last Updated: 2007-03-29
Relevant URL: http://www.securityfocus.com/bid/18682
Summary:
Microsoft Internet Explorer is prone to an information-disclosure vulnerability because it fails to properly enforce cross-domain policies.

This issue may allow attackers to access arbitrary websites in the context of a targeted user's browser session. This may allow attackers to perform actions in web applications with the privileges of exploited users or to gain access to potentially sensitive information. This may aid attackers in further attacks.

44. Microsoft Internet Explorer Frameset Memory Corruption Vulnerability
BugTraq ID: 18277
Remote: Yes
Last Updated: 2007-03-29
Relevant URL: http://www.securityfocus.com/bid/18277
Summary:
Microsoft Internet Explorer is affected by a memory-corruption vulnerability. This issue arises because the application fails to handle exceptional conditions in a proper manner.

An attacker may exploit this issue by enticing a user to visit a malicious site and then to click anywhere on the page. This results in a denial-of-service condition in the application.

The vendor reports this issue may also be exploited to execute arbitrary code in the context of the victim user.

45. Microsoft Internet Explorer Deleted Frame Object Denial Of Service Vulnerability
BugTraq ID: 19228
Remote: Yes
Last Updated: 2007-03-29
Relevant URL: http://www.securityfocus.com/bid/19228
Summary:
Microsoft Internet Explorer is prone to a denial-of-service vulnerability. This issue is triggered when an attacker convinces a victim user to visit a malicious website.

Remote attackers may exploit this issue to crash Internet Explorer, effectively denying service to legitimate users.

46. Microsoft Internet Explorer HTML Layout and Positioning Remote Code Execution Vulnerability
BugTraq ID: 19312
Remote: Yes
Last Updated: 2007-03-29
Relevant URL: http://www.securityfocus.com/bid/19312
Summary:
Microsoft Internet Explorer is prone to a remote code-execution vulnerability.

This vulnerability is related to how the browser renders HTML with certain layout and positioning combinations. An attacker could exploit this issue to execute arbitrary code in the context of the user visiting a malicious web page.

This issue affects Internet Explorer on Windows 2000, Windows XP, and Windows Server 2003.

47. Microsoft Internet Explorer Chained Cascading Style Sheets Remote Code Execution Vulnerability
BugTraq ID: 19316
Remote: Yes
Last Updated: 2007-03-29
Relevant URL: http://www.securityfocus.com/bid/19316
Summary:
Microsoft Internet Explorer is prone to remote code-execution vulnerability.

This issue is related to how the browser handles chained CSS (Cascading Style Sheets). An attacker could exploit this issue to execute arbitrary code in the context of the user visiting a malicious web page.

This issue affects Internet Explorer on Windows 2000, Windows XP (excluding XP SP2), and Windows Server 2003.

48. Microsoft Internet Explorer Window Location Cross-Domain Information Disclosure Vulnerability
BugTraq ID: 19339
Remote: Yes
Last Updated: 2007-03-29
Relevant URL: http://www.securityfocus.com/bid/19339
Summary:
Microsoft Internet Explorer is prone to a cross-domain information-disclosure vulnerability.

This vulnerability may let a malicious website access properties of a site in an arbitrary external domain. Attackers could exploit this issue to gain access to sensitive information that is associated with the external domain.

49. Microsoft Internet Explorer COM Object Instantiation Code Execution Vulnerability
BugTraq ID: 19340
Remote: Yes
Last Updated: 2007-03-29
Relevant URL: http://www.securityfocus.com/bid/19340
Summary:
Microsoft Internet Explorer is prone to a memory-corruption vulnerability that is related to the instantiation of COM objects. This issue stems from a design error.

The vulnerability arises because of the way Internet Explorer tries to instantiate certain COM objects as ActiveX controls, resulting in arbitrary code execution. The affected objects are not intended to be instantiated through Internet Explorer.

50. Microsoft Internet Explorer Source Element Cross-Domain Information Disclosure Vulnerability
BugTraq ID: 19400
Remote: Yes
Last Updated: 2007-03-29
Relevant URL: http://www.securityfocus.com/bid/19400
Summary:
Microsoft Internet Explorer is prone to an information-disclosure vulnerability because it fails to properly enforce cross-domain policies.

51. Microsoft Internet Explorer HTTP 1.1 and Compression Long URI Buffer Overflow Vulnerability
BugTraq ID: 19667
Remote: Yes
Last Updated: 2007-03-29
Relevant URL: http://www.securityfocus.com/bid/19667
Summary:
Microsoft Internet Explorer is prone to a remote buffer-overflow vulnerability. A successful exploit may result in arbitrary code-execution in the context of the user running the browser.

This issue was introduced with the patches released with Microsoft advisory MS06-042.

Internet Explorer 6 SP1 running on Microsoft Windows 2000 and Windows XP SP1 is vulnerable to this issue.

52. Microsoft Internet Explorer HTTP 1.1 and Compression Long URI Buffer Overflow Variant Vulnerability
BugTraq ID: 19987
Remote: Yes
Last Updated: 2007-03-29
Relevant URL: http://www.securityfocus.com/bid/19987
Summary:
Microsoft Internet Explorer is prone to a remote buffer-overflow vulnerability. A successful exploit may result in arbitrary code-execution in the context of the user running the browser.

This issue was introduced with the rereleased patches of Microsoft advisory MS06-042.

This issue is nearly identical to that discussed in BID 19667 (Microsoft Internet Explorer HTTP 1.1 and Compression Long URI Buffer Overflow Vulnerability), but is a separate vulnerability.

53. PHP Session.Save_Path() TMPDIR Open_Basedir Restriction Bypass Vulnerability
BugTraq ID: 23183
Remote: No
Last Updated: 2007-03-29
Relevant URL: http://www.securityfocus.com/bid/23183
Summary:
PHP is prone to a 'open_basedir' restriction-bypass vulnerability due to a design error.

Successful exploits could allow an attacker to access sensitive information or to write files in unauthorized locations.

This vulnerability would be an issue in shared-hosting configurations where multiple users can create and execute arbitrary PHP script code; in such cases, the 'safe_mode' and 'open_basedir' restrictions are expected to isolate users from each other.

The following versions are vulnerable:

PHP 4 up to and including 4.4.6
PHP 5 up to and including 5.2.1

54. Data Domain Administration Interface Local Privilege Escalation Vulnerability
BugTraq ID: 23182
Remote: No
Last Updated: 2007-03-29
Relevant URL: http://www.securityfocus.com/bid/23182
Summary:
Data Domain is prone to a local privilege-escalation vulnerability because the application fails to sanitize user-supplied input before passing it to a UNIX shell for execution.

An attacker can exploit this issue to install malicious software and execute arbitrary commands with superuser privileges. Successfully exploiting this issue will result in the complete compromise of affected computers.

This issue affects Data Domain 3.0.0 through 4.0.3.5.

55. MsxStudios Advanced Login ProfileEdit.PHP Remote File Include Vulnerability
BugTraq ID: 23197
Remote: Yes
Last Updated: 2007-03-29
Relevant URL: http://www.securityfocus.com/bid/23197
Summary:
Advanced Login is prone to a remote file-include vulnerability because it fails to sufficiently sanitize user-supplied input.

Exploiting this issue may allow an attacker to compromise the application and the underlying system; other attacks are also possible.

This issue affects Advanced Login 0.7; other versions may also be vulnerable.

56. FastStone Image Viewer Unspecified Buffer Overflow Vulnerability
BugTraq ID: 23196
Remote: Yes
Last Updated: 2007-03-29
Relevant URL: http://www.securityfocus.com/bid/23196
Summary:
FastStone Image Viewer is prone to an unspecified buffer-overflow vulnerability. This issue occurs because the application fails to bounds-check user-supplied data before copying it into an insufficiently sized buffer.

An attacker can exploit this issue to execute arbitrary code within the context of the user running the affected application. Failed exploit attempts will result in a denial-of-service.

Currently, limited information is currently available regarding this issue. This BID will be updated as more information becomes available.

This issue affects version 2.8; other versions may also be affected.

57. ViewCVS Source View Input Validation Vulnerability
BugTraq ID: 12112
Remote: Yes
Last Updated: 2007-03-28
Relevant URL: http://www.securityfocus.com/bid/12112
Summary:
ViewCVS is prone to an input-validation vulnerability.

This issue resides in the script that allows users to view source files (viewcvs.py). The software fails to sufficiently sanitize nput supplied through URI parameters, allowing an attacker to launch cross-site scripting and HTTP-response-splitting attacks.

Exploitation could allow the attacker to steal cookie-based authentications and launch other attacks.

This issue appears similar to BID 9291.

58. IBM Lotus Domino LDAP Server Task Heap-Based Buffer Overflow Vulnerability
BugTraq ID: 23174
Remote: Yes
Last Updated: 2007-03-28
Relevant URL: http://www.securityfocus.com/bid/23174
Summary:
IBM Lotus Domino Server is prone to a remote buffer-overflow vulnerability because it fails to properly bounds-check user-supplied data before copying it to an insufficiently sized memory buffer.

An attacker can exploit this issue to execute arbitrary code within the context of the affected application. Failed exploit attempts will result in a denial of service.

59. IBM Lotus Domino IMAP Cram-MD5 Buffer Overflow Vulnerability
BugTraq ID: 23172
Remote: Yes
Last Updated: 2007-03-28
Relevant URL: http://www.securityfocus.com/bid/23172
Summary:
IBM Lotus Domino Server is prone to a remote buffer-overflow vulnerability because it fails to properly bounds-check user-supplied data before copying it to an insufficiently sized memory buffer.

An attacker can exploit this issue to execute arbitrary code within the context of the affected application. Failed exploit attempts will result in a denial of service.

60. Cisco Unified CallManager And Unified Server Multiple Remote Denial Of Service Vulnerabilities
BugTraq ID: 23181
Remote: Yes
Last Updated: 2007-03-28
Relevant URL: http://www.securityfocus.com/bid/23181
Summary:
Cisco Unified CallManager (CUCM) and Cisco Unified Presence Server (CUPS) are prone to multiple remote denial-of-service vulnerabilities. These issues occur because the devices fail to handle certain network packets or network requests.

An attacker can exploit these issues to crash the affected services on the devices, denying service to legitimate users.

61. TrueCrypt Mount Set-EUID Local Privilege Escalation Vulnerability
BugTraq ID: 23180
Remote: No
Last Updated: 2007-03-28
Relevant URL: http://www.securityfocus.com/bid/23180
Summary:
Truecrypt is prone to a local privilege-escalation vulnerability.

Exploiting this issue allows local attackers to attain superuser privileges, which can lead to a complete system compromise.

This issue affects version 4.3; earlier versions may also be vulnerable.

62. OpenOffice Meta Character Remote Shell Command Execution Vulnerability
BugTraq ID: 22812
Remote: Yes
Last Updated: 2007-03-28
Relevant URL: http://www.securityfocus.com/bid/22812
Summary:
OpenOffice is prone to a vulnerability that allows arbitrary shell commands to run because the software fails to sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary shell commands on an affected computer with the privileges of the applicaiton.

63. LibWPD Library Multiple Buffer Overflow Vulnerabilities
BugTraq ID: 23006
Remote: Yes
Last Updated: 2007-03-28
Relevant URL: http://www.securityfocus.com/bid/23006
Summary:
The libwpd library is prone to multiple buffer-overflow vulnerabilities because it fails to adequately check boundaries on user-supplied input.

A successful exploit could let a remote attacker execute arbitrary code in the context of an application using the affected library.

Version 0.8.7 is vulnerable; other versions prior to 0.8.9 may also be affected.

64. OSTicket Multiple Input Validation Vulnerabilities
BugTraq ID: 14127
Remote: Yes
Last Updated: 2007-03-28
Relevant URL: http://www.securityfocus.com/bid/14127
Summary:
osTicket is affected by multiple input-validation vulnerabilities because the application fails to sufficiently sanitize user-supplied data.

The following specific issues were identified:

- An SQL-injection vulnerability. A successful exploit could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database implementation.

- A local file-include vulnerability. An attacker may leverage this issue to execute arbitrary server-side script code that resides on an affected computer with the privileges of the webserver process. This may facilitate unauthorized access.

osTicket 1.3.1 beta and prior versions are affected.

65. Mozilla Firefox Javascript URI Remote Code Execution Vulnerability
BugTraq ID: 22826
Remote: Yes
Last Updated: 2007-03-28
Relevant URL: http://www.securityfocus.com/bid/22826
Summary:
Mozilla Firefox is prone to a remote code-execution vulnerability due to a design error.

Attackers may exploit this issue by enticing victims into visiting a malicious site.

Successful exploits may allow an attacker to crash the application or execute arbitrary code in the context of the affected application.

66. Mozilla Firefox OnUnload Memory Corruption Vulnerability
BugTraq ID: 22679
Remote: Yes
Last Updated: 2007-03-28
Relevant URL: http://www.securityfocus.com/bid/22679
Summary:
Mozilla Firefox is prone to a remote memory-corruption vulnerability.

Successfully exploiting this issue may allow remote attackers to execute arbitrary machine code in the context of the affected application. This could facilitate the remote compromise of affected computers.

Mozilla Firefox version 2.0.0.1 is vulnerable to this issue; other versions are also likely affected.

67. NaviCopa Web Server GET Request Buffer Overflow Vulnerability
BugTraq ID: 23179
Remote: Yes
Last Updated: 2007-03-28
Relevant URL: http://www.securityfocus.com/bid/23179
Summary:
NaviCOPA Web Server is prone to a buffer-overflow vulnerability because it fails to adequately bounds-check user-supplied data before copying it to an insufficiently sized buffer.

Attackers can exploit this issue to execute arbitrary code with the privileges of the application. Successful attacks will result in the compromise of the application. Failed attempts will likely cause denial-of-service conditions.

Version 2.01 is vulnerable; prior versions may also be affected.

68. OpenOffice StarCalc Parser Unspecified Buffer Overflow Vulnerability
BugTraq ID: 23067
Remote: Yes
Last Updated: 2007-03-28
Relevant URL: http://www.securityfocus.com/bid/23067
Summary:
OpenOffice is prone to a remote stack-based buffer-overflow vulnerability. This issue occurs because the application fails to bounds-check user-supplied data before copying it into an insufficiently sized buffer.

An attacker can exploit this issue to execute arbitrary code within the context of the affected application. Failed exploit attempts will result in a denial-of-service.

69. Microsoft Internet Explorer HTML Denial of Service Vulnerability
BugTraq ID: 23178
Remote: Yes
Last Updated: 2007-03-28
Relevant URL: http://www.securityfocus.com/bid/23178
Summary:
Microsoft Internet Explorer is prone to a denial-of-service vulnerability because the application fails to handle exceptional conditions.

This issue is triggered when an attacker entices a victim user to visit a malicious website.

Remote attackers may exploit this issue to crash Internet Explorer, effectively denying service to legitimate users.

This issue affects Internet Explorer version 7.

70. Mozilla Firefox Popup Blocker Cross Zone Security Bypass Weakness
BugTraq ID: 22396
Remote: Yes
Last Updated: 2007-03-28
Relevant URL: http://www.securityfocus.com/bid/22396
Summary:
Mozilla Firefox is prone to a cross-zone security-bypass weakness. This issue allows attackers to open 'file://' URIs from remote websites.

By exploiting this issue in conjunction with other weaknesses or vulnerabilities, attackers may be able to execute arbitrary script code with the elevated privileges that are granted to scripts when they are executed from local sources.

Mozilla Firefox 1.5.0.9 is affected by this issue; other versions may be affected as well.

71. Mozilla Firefox Location.Hostname Dom Property Cookie Theft Vulnerability
BugTraq ID: 22566
Remote: Yes
Last Updated: 2007-03-28
Relevant URL: http://www.securityfocus.com/bid/22566
Summary:
Mozilla Firefox is prone to a vulnerability that allows attackers to steal cookies. This issue occurs because the application fails to sufficiently sanitize user-supplied input.

An attacker can exploit this issue to manipulate cookie-based authentication credentials for third-party web pages or to control how the site is rendered to the user. Exploiting this issue may allow the attacker to bypass the same-origin policy for cross-window/cross-frame data access; other attacks are also possible.

This issue affects version 2.0.0.1; prior versions may also be affected.

72. Mozilla Thunderbird/SeaMonkey/Firefox Multiple Remote Vulnerabilities
BugTraq ID: 22694
Remote: Yes
Last Updated: 2007-03-28
Relevant URL: http://www.securityfocus.com/bid/22694
Summary:
The Mozilla Foundation has released six security advisories specifying vulnerabilities in Firefox, SeaMonkey, and Thunderbird.

These vulnerabilities allow attackers to:

- Execute arbitrary code
- Cause denial-of-service conditions
- Perform cross-site scripting attacks
- Obtain potentially sensitive information
- Spoof legitimate content

Other attacks may also be possible.

73. IBM Lotus Domino Web Access Email Message HTML Injection Vulnerability
BugTraq ID: 23173
Remote: Yes
Last Updated: 2007-03-28
Relevant URL: http://www.securityfocus.com/bid/23173
Summary:
IBM Lotus Domino Web Access is prone to an HTML-injection vulnerability because it fails to sufficiently sanitize user-supplied data.

An attacker could exploit this vulnerability to execute arbitrary script code in the browser of an unsuspecting victim in the context of the affected website. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

74. Xoops Articles Module Print.PHP SQL Injection Vulnerability
BugTraq ID: 23160
Remote: Yes
Last Updated: 2007-03-28
Relevant URL: http://www.securityfocus.com/bid/23160
Summary:
The Xoops Articles module is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Xoops Articles module prior to version 1.03 are reported vulnerable.

75. Corel WordPerfect Office PRS Stack Buffer Overflow Vulnerability
BugTraq ID: 23177
Remote: Yes
Last Updated: 2007-03-28
Relevant URL: http://www.securityfocus.com/bid/23177
Summary:
Corel WordPerfect Office is prone to a stack-based buffer-overflow vulnerability because the software fails to adequately bounds-check user-supplied data before copying it to an insufficiently sized buffer.

An attacker can exploit this issue to execute arbitrary code with the privileges of the user running the application. A successful attack can result in the compromise of the application. Failed attempts will likely result in denial-of-service conditions.

WordPerfect X3 version 13.0.0.565 is vulnerable to this issue; other versions may also be affected.

76. NaviCOPA Web Server Remote Buffer Overflow Vulnerability
BugTraq ID: 20250
Remote: Yes
Last Updated: 2007-03-28
Relevant URL: http://www.securityfocus.com/bid/20250
Summary:
NaviCOPA Web Server is prone to a remote buffer-overflow vulnerability because the application fails to properly bounds-check user-supplied input before copying it to an insufficiently sized memory buffer.

This vulnerability may lead to the execution of arbitrary code or to denial-of-service conditions. This may facilitate the remote compromise of affected computers.

NaviCOPA Web Server version 2.01 is vulnerable to this issue; other versions may also be affected.

77. Eve-Nuke Forums MySQL.PHP Remote File Include Vulnerability
BugTraq ID: 23176
Remote: Yes
Last Updated: 2007-03-28
Relevant URL: http://www.securityfocus.com/bid/23176
Summary:
Eve-Nuke Forums is prone to a remote file-include vulnerability because it fails to sufficiently sanitize user-supplied data.

Exploiting this issue may allow an attacker to compromise the application and the underlying system; other attacks are also possible.

78. ESRI ArcSDE Server Unspecified Denial Of Service Vulnerability
BugTraq ID: 23175
Remote: Yes
Last Updated: 2007-03-28
Relevant URL: http://www.securityfocus.com/bid/23175
Summary:
ESRI ArcSDE Server is prone to an unspecified denial-of-service vulnerability.

An attacker can exploit this issue on an affected computer to deny service to legitimate users.

ESRI ArcSDE Server versions 8.3, 9.0, and 9.1 are vulnerable to this issue.

79. AY System Solutions Web Content System Remote File Include Vulnerability
BugTraq ID: 23171
Remote: Yes
Last Updated: 2007-03-28
Relevant URL: http://www.securityfocus.com/bid/23171
Summary:
Web Content System is prone to a remote file-include vulnerability because it fails to sufficiently sanitize user-supplied data.

Exploiting this issue may allow an attacker to compromise the application and the underlying system; other attacks are also possible.

This issue affects version 2.7.1; other versions may also be affected.

80. ISC BIND Remote DNSSEC Validation Denial of Service Vulnerability
BugTraq ID: 22231
Remote: Yes
Last Updated: 2007-03-28
Relevant URL: http://www.securityfocus.com/bid/22231
Summary:
ISC BIND is prone to a remote denial-of-service vulnerability because the application fails to properly handle malformed DNSSEC validation requests.

Successfully exploiting this issue allows remote attackers to crash affected DNS servers, denying further service to legitimate users.

81. XMMS Skins Integer Overflow And Underflow Vulnerabilities
BugTraq ID: 23078
Remote: Yes
Last Updated: 2007-03-28
Relevant URL: http://www.securityfocus.com/bid/23078
Summary:
XMMS is prone to an integer-overflow vulnerability and an integer-underflow vulnerability because it fails to adequately handle user-supplied data.

An attacker can leverage these issues to corrupt stack-based memory and execute arbitrary code with the privileges of a user running the application. A successful attack may result in the compromise of affected computers. Failed attempts will likely cause denial-of-service conditions.

Version 1.2.10 is vulnerable; other versions may also be affected.

82. Network Audio System Local Privilege Escalation and Denial of Service Vulnerabilities
BugTraq ID: 23017
Remote: Yes
Last Updated: 2007-03-28
Relevant URL: http://www.securityfocus.com/bid/23017
Summary:
Network Audio System is prone to local privilege-escalation and denial-of-service vulnerabilities.

An attacker can exploit these issues to execute arbitrary commands with root privileges or to overwrite arbitrary system files, resulting in denial-of-service conditions.

Network Audio System version 1.8a is affected; other versions may also be vulnerable.

83. PHP Zip_Entry_Read() Integer Overflow Vulnerability
BugTraq ID: 23169
Remote: Yes
Last Updated: 2007-03-28
Relevant URL: http://www.securityfocus.com/bid/23169
Summary:
PHP is prone to an integer-overflow vulnerability because it fails to ensure that integer values aren't overrun. Attackers may exploit this issue to cause a heap-based buffer overflow.

Exploiting this issue may allow attackers to execute arbitrary machine code in the context of the affected application. Failed exploit attempts will likely result in a denial-of-service condition.

This issue affects PHP versions prior to 4.4.5.

84. JBrowser Upload.PHP3 Arbitrary File Upload Vulnerability
BugTraq ID: 23166
Remote: Yes
Last Updated: 2007-03-28
Relevant URL: http://www.securityfocus.com/bid/23166
Summary:
JBrowser is prone to an arbitrary-file-upload vulnerability.

An attacker can exploit this vulnerability to upload PHP script code and execute it in the context of the webserver process.

JBrowser 2.4 and prior versions are vulnerable.

85. Mozilla Firefox 2 Password Manager Cross-Site Information Disclosure Weakness
BugTraq ID: 21240
Remote: Yes
Last Updated: 2007-03-28
Relevant URL: http://www.securityfocus.com/bid/21240
Summary:
Mozilla Firefox is reportedly prone to an information-disclosure weakness because it fails to properly notify users of the automatic population of form fields in disparate URLs deriving from the same domain.

Exploiting this issue may allow attackers to obtain user credentials that have been saved in forms deriving from the same website where attack code resides. The most common manifestation of this condition would typically be in blogs or forums. This may allow attackers to access potentially sensitive information that would facilitate the success of phishing attacks.

Initial reports and preliminary testing indicate that this issue affects only Firefox 2.

86. CodeBB PHPBB_Root_Path Remote File Include Vulnerability
BugTraq ID: 23185
Remote: Yes
Last Updated: 2007-03-28
Relevant URL: http://www.securityfocus.com/bid/23185
Summary:
CodeBB is prone to a remote file-include vulnerability because it fails to sufficiently sanitize user-supplied data.

Exploiting this issue may allow an attacker to compromise the application and the underlying system; other attacks are also possible.

This issue affects version 1.0 Beta 2; other versions may also be affected.

87. HP Jetdirect FTP Print Server RERT Command Denial Of Service Vulnerability
BugTraq ID: 23168
Remote: Yes
Last Updated: 2007-03-27
Relevant URL: http://www.securityfocus.com/bid/23168
Summary:
HP JetDirect FTP Print Server is prone to a remote denial-of-service vulnerability.

An attacker can exploit this issue on an affected computer to deny service to legitimate users.

FTP Print Server 2.4 and prior versions are vulnerable.

88. Free File Hosting Forgot_Pass.PHP Remote File Include Vulnerability
BugTraq ID: 20781
Remote: Yes
Last Updated: 2007-03-27
Relevant URL: http://www.securityfocus.com/bid/20781
Summary:
Free File Hosting is prone to a remote file-include vulnerability because it fails to properly sanitize user-supplied input.

A successful exploit of this issue allows an attacker to execute arbitrary server-side script code on an affected computer with the privileges of the webserver process. This may facilitate unauthorized access.

Free File Hosting 1.1 and prior versions are vulnerable.

89. Free File Hosting System Multiple Remote File Include Vulnerabilities
BugTraq ID: 23118
Remote: Yes
Last Updated: 2007-03-27
Relevant URL: http://www.securityfocus.com/bid/23118
Summary:
Free File Hosting is prone to multiple remote file-include vulnerabilities because it fails to sufficiently sanitize user-supplied data.

Exploiting these issues may allow an attacker to compromise the application and the underlying system; other attacks are also possible.

Version 1.1 is vulnerable to these issues.

This BID was incorrectly reporting Free File Upload script as the affected package. Free File Upload script is the demo version of the Free File Hosting script.

This issue is related to BID 20781 - Free File Hosting Forgot_Pass.PHP Remote File Include Vulnerability.

90. ABitWhizzy Multiple Cross Site Scripting And Directory Traversal Vulnerabilities
BugTraq ID: 23167
Remote: Yes
Last Updated: 2007-03-27
Relevant URL: http://www.securityfocus.com/bid/23167
Summary:
aBitWhizzy is prone to multiple cross-site scripting and directory-traversal vulnerabilities because the application fails to sufficiently sanitize user-supplied input.

An attacker could exploit these vulnerabilities to view the directory structure on the affected webserver and perform cross-site scripting attacks on unsuspecting users in the context of the affected website. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

91. Oracle July 2006 Security Update Multiple Vulnerabilities
BugTraq ID: 19054
Remote: Yes
Last Updated: 2007-03-27
Relevant URL: http://www.securityfocus.com/bid/19054
Summary:
Various Oracle applications including Oracle Database, Oracle Application Server, Oracle Collaboration Suite, Oracle E-Business Suite and Applications, Oracle Pharmaceutical Applications, Oracle Enterprise Manager, Oracle PeopleSoft Enterprise, and JD Edwards EnterpriseOne are affected by multiple vulnerabilities.

Oracle has released a Critical Patch Update advisory for July 2006 to address these vulnerabilities. This Critical Patch Update addresses the vulnerabilities for supported releases. Earlier unsupported releases are likely to be affected by the issues as well.

These issues will be split into individual records when more information has been disclosed.

92. Joomla! D4JeZine Component Index.PHP SQL Injection Vulnerability
BugTraq ID: 23165
Remote: Yes
Last Updated: 2007-03-27
Relevant URL: http://www.securityfocus.com/bid/23165
Summary:
The Joomla! D4JeZine component is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Version 2.8 is vulnerable; other versions may also be affected.

93. HP OpenView Network Node Manager Unspecified Remote Unauthorized Access Vulnerability
BugTraq ID: 23163
Remote: Yes
Last Updated: 2007-03-27
Relevant URL: http://www.securityfocus.com/bid/23163
Summary:
OpenView Network Node Manager is prone to an unauthorized-access vulnerability.

An attacker can exploit this issue to gain remote unauthorized access to the affected application.

This issue affects the following versions:

6.20
6.40 branch
7.01
7.50
7.51

94. FlexBB Start.PHP SQL Injection Vulnerability
BugTraq ID: 23161
Remote: Yes
Last Updated: 2007-03-27
Relevant URL: http://www.securityfocus.com/bid/23161
Summary:
FlexBB is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database implementation.

95. Mozilla FireFox FTP PASV Port-Scanning Vulnerability
BugTraq ID: 23082
Remote: Yes
Last Updated: 2007-03-27
Relevant URL: http://www.securityfocus.com/bid/23082
Summary:
Mozilla Firefox is prone to vulnerability that may allow attackers to obtain potentially sensitive information.

96. Gnome Evolution Format String Vulnerability
BugTraq ID: 23073
Remote: Yes
Last Updated: 2007-03-27
Relevant URL: http://www.securityfocus.com/bid/23073
Summary:
Gnome Evolution is prone to a format-string vulnerability.

This issue presents itself because the application fails to properly sanitize user-supplied input before passing it as the format specifier in a shared memo.

Gnome Evolution version 2.8.2.1 is vulnerable to this issue; other versions may also be affected.

97. Horde Groupware Webmail Edition Unspecified Parameters Multiple HTML Injection Vulnerabilities
BugTraq ID: 23136
Remote: Yes
Last Updated: 2007-03-27
Relevant URL: http://www.securityfocus.com/bid/23136
Summary:
Horde Groupware Webmail Edition is prone to multiple HTML-injection vulnerabilities because it fails to sufficiently sanitize user-supplied input data.

Exploiting these issues may allow an attacker to execute HTML and script code in the context of the affected site, to steal cookie-based authentication credentials, or to control how the site is rendered to the user; other attacks are also possible.

Version 1.0 is vulnerable; other versions may also be affected.

98. Mozilla Firefox/SeaMonkey/Thunderbird Multiple Remote Vulnerabilities
BugTraq ID: 21668
Remote: Yes
Last Updated: 2007-03-27
Relevant URL: http://www.securityfocus.com/bid/21668
Summary:
The Mozilla Foundation has released nine security advisories specifying vulnerabilities in Firefox, SeaMonkey, and Thunderbird.

These vulnerabilities allow attackers to:

- execute arbitrary code
- perform cross-site scripting attacks
- inject arbitrary content
- gain escalated privileges
- crash affected applications and potentially execute arbitrary code.

Other attacks may also be possible.

99. Microsoft Windows Vista Windows Mail Local File Execution Vulnerability
BugTraq ID: 23103
Remote: Yes
Last Updated: 2007-03-27
Relevant URL: http://www.securityfocus.com/bid/23103
Summary:
Microsoft Windows Vista Windows Mail is prone to a local file-execution vulnerability due to a design error.

An attackers may exploit this issue to execute local files. The attacker must entice a victim into opening a maliciously crafted link using the affected application.

Note: We were unable to reproduce this vulnerability using a default Microsoft Windows Vista installation. Symantec is currently investigating this issue further.

100. IceBB Avatar Upload Index.PHP SQL Injection Vulnerability
BugTraq ID: 23158
Remote: Yes
Last Updated: 2007-03-27
Relevant URL: http://www.securityfocus.com/bid/23158
Summary:
IceBB is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database implementation.

IceBB version 1.0-rc5 is vulnerable; other versions may also be affected.

III. SECURITYFOCUS NEWS ARTICLES
--------------------------------
1. Groups team to test secure-coding skill
By: Robert Lemos
A coalition of security companies and organizations team to create assessment tests to certify programmers knowledge of secure-coding practices.
http://www.securityfocus.com/news/11454

2. Oracle sues rival for hacking, data theft
By: Robert Lemos
The database and enterprise software firm files a lawsuit against competitor SAP claiming that the German firm pilfered an enormous number of documents and software from Oracle's customer-only support systems.
http://www.securityfocus.com/news/11453

3. Account pretexters plague Xbox Live
By: Robert Lemos
An increasing number of players on Microsoft's gaming system claim their accounts have been stolen by teams of cheaters looking for further advantage.
http://www.securityfocus.com/news/11452

4. Anti-spyware bill could mean tougher fines
By: Robert Lemos
Supporters of the Spy Act, which heightens civil penalties against those responsible for programs that hijack PCs and collect data without adequate authorization, hope that the bill's third time is a charm.
http://www.securityfocus.com/news/11450

IV. SECURITY JOBS LIST SUMMARY
-------------------------------
1. [SJ-JOB] Security Consultant, Hertfordshire
http://www.securityfocus.com/archive/77/464042

2. [SJ-JOB] Sales Engineer, Reston
http://www.securityfocus.com/archive/77/464043

3. [SJ-JOB] Application Security Architect, Baltimore
http://www.securityfocus.com/archive/77/464032

4. [SJ-JOB] Sr. Product Manager, Mountain View
http://www.securityfocus.com/archive/77/464029

5. [SJ-JOB] Customer Service, Mountain View
http://www.securityfocus.com/archive/77/464030

6. [SJ-JOB] Software Engineer, Mountain View
http://www.securityfocus.com/archive/77/464027

7. [SJ-JOB] Security System Administrator, Capitol area
http://www.securityfocus.com/archive/77/464028

8. [SJ-JOB] Security Consultant, New York
http://www.securityfocus.com/archive/77/463677

9. [SJ-JOB] Security Consultant, Bellevue
http://www.securityfocus.com/archive/77/463636

10. [SJ-JOB] Security Engineer, Waqshington
http://www.securityfocus.com/archive/77/463640

11. [SJ-JOB] Security Consultant, Leawood
http://www.securityfocus.com/archive/77/463661

12. [SJ-JOB] Manager, Information Security, mumbai
http://www.securityfocus.com/archive/77/463638

13. [SJ-JOB] Security Consultant, Houston
http://www.securityfocus.com/archive/77/463641

14. [SJ-JOB] Security Consultant, Atlanta
http://www.securityfocus.com/archive/77/463662

15. [SJ-JOB] Sales Engineer, Detroit
http://www.securityfocus.com/archive/77/463663

16. [SJ-JOB] Sales Engineer, Chicago
http://www.securityfocus.com/archive/77/463664

17. [SJ-JOB] Security Consultant, San Francisco
http://www.securityfocus.com/archive/77/463637

18. [SJ-JOB] Sales Engineer, Irvine
http://www.securityfocus.com/archive/77/463665

19. [SJ-JOB] Channel / Business Development, Seattle
http://www.securityfocus.com/archive/77/463623

20. [SJ-JOB] Account Manager, Redwood City
http://www.securityfocus.com/archive/77/463624

21. [SJ-JOB] Channel / Business Development, Portland
http://www.securityfocus.com/archive/77/463625

22. [SJ-JOB] Sales Engineer, Redwood City
http://www.securityfocus.com/archive/77/463613

23. [SJ-JOB] Information Assurance Analyst, Mountain View
http://www.securityfocus.com/archive/77/463614

24. [SJ-JOB] Security Auditor, London
http://www.securityfocus.com/archive/77/463616

25. [SJ-JOB] Sales Engineer, San Diego
http://www.securityfocus.com/archive/77/463617

26. [SJ-JOB] Account Manager, Brookfield
http://www.securityfocus.com/archive/77/463627

27. [SJ-JOB] Quality Assurance, Cambridge
http://www.securityfocus.com/archive/77/463615

28. [SJ-JOB] Security Consultant, Berkshire
http://www.securityfocus.com/archive/77/463626

29. [SJ-JOB] Forensics Engineer, San Francisco
http://www.securityfocus.com/archive/77/463605

30. [SJ-JOB] Security Consultant, Berkshire / Hampshire
http://www.securityfocus.com/archive/77/463604

31. [SJ-JOB] Technical Support Engineer, West London
http://www.securityfocus.com/archive/77/463606

32. [SJ-JOB] Security Architect, Surrey / Berkshire
http://www.securityfocus.com/archive/77/463607

33. [SJ-JOB] Security System Administrator, University Park
http://www.securityfocus.com/archive/77/463608

34. [SJ-JOB] Sales Engineer, Dallas
http://www.securityfocus.com/archive/77/463554

35. [SJ-JOB] Sales Engineer, New York City
http://www.securityfocus.com/archive/77/463557

36. [SJ-JOB] Sales Engineer, Houston
http://www.securityfocus.com/archive/77/463558

37. [SJ-JOB] Security Consultant, Herndon
http://www.securityfocus.com/archive/77/463553

38. [SJ-JOB] Application Security Engineer, Arlington
http://www.securityfocus.com/archive/77/463555

V. INCIDENTS LIST SUMMARY
---------------------------
VI. VULN-DEV RESEARCH LIST SUMMARY
-----------------------------------
1. Metasploit Framework 3.0 RELEASED!
http://www.securityfocus.com/archive/82/464167

VII. MICROSOFT FOCUS LIST SUMMARY
---------------------------------
1. Multiple Profile ~ XP
http://www.securityfocus.com/archive/88/463814

2. Administrivia: New List Moderators
http://www.securityfocus.com/archive/88/463538

3. Administrivia: Farewell
http://www.securityfocus.com/archive/88/463531

4. Shared drives through a firewall
http://www.securityfocus.com/archive/88/463468

VIII. SUN FOCUS LIST SUMMARY
----------------------------
IX. LINUX FOCUS LIST SUMMARY
----------------------------
X. UNSUBSCRIBE INSTRUCTIONS
-----------------------------
To unsubscribe send an e-mail message to sf-news-unsubscribe@securityfocus.com from the subscribed address. The contents of the subject or message body do not matter. You will receive a confirmation request message to which you will have to answer. Alternatively you can also visit http://www.securityfocus.com/newsletters and unsubscribe via the website.

If your email address has changed email listadmin@securityfocus.com and ask to be manually removed.

XI. SPONSOR INFORMATION
------------------------
This Issue is Sponsored by: SPI Dynamics

https://download.spidynamics.com/1/ad/sql.asp?Campaign_ID=70160000000CkvN

News

Thursday, March 29, 2007

SecurityFocus Newsletter #394

No comments:

WINDOWS CENTER

Blog Archive